How to configure accessFlow Code Agent

Customize how accessFlow Code Agent scans pull requests (PRs) and your repository. Configure which issues PR scans report, schedule repo scans that open PRs with suggested fixes, and choose which files and rules each scan excludes.

Set up the configuration file

Create a file named .codeagent.yml in the root (top level) of your repository. Use the settings in this article to configure PR scans, repo scans, or both. For repo scans, the file must be on your default branch.

Make sure you have activated the required permissions in Github.

PR scan configuration options

You can customize the following settings:

`severityThreshold`

Controls which accessibility issues the reviewer reports based on severity.

By default, all accessibility issues are reported. You can limit this to only report issues of a certain severity or higher.

Values: "low", "medium", "high", "extreme"
Default: "low" (reports everything)

`blockingSeverity`

Controls which accessibility issues can block a PR from being merged.

Values: "low", "medium", "high", "extreme"
Default: "high"

When the AI Reviewer finds an open issue at or above the configured blockingSeverity, the check run fails. The check run continues to fail until all blocking issues are fixed or dismissed.

Once no open issues meet the blocking threshold, the check run passes automatically. Lower-severity issues can remain open without keeping the PR blocked.

`ignoreRules`

Exclude specific accessibility rules from being reported. Use this if certain rules do not apply to your project.

Values: A list of rule IDs (e.g., alt-misuse, button-mismatch).
Default: [] (empty list)

`autoReview`

Determines whether the AI Reviewer runs automatically on PRs. When set to true, the reviewer scans your code whenever a PR is opened or updated.

Set to false to run the AI reviewer manually.

Values: true, false
Default: true

`excludeFiles`

Define files or directories the reviewer should skip. This is useful for excluding: legacy code, test files, third party libraries, or vendor assets.

Use standard glob patterns to define exclusions. Ignored files are cleanly logged under the “Ignored Files” section in the PR check-run summary.

Values: A list of standard glob patterns (e.g., legacy-assets/**, app/components/third-party/*.tsx).
Default: The AI reviewer automatically ignores common non-production files, test files, package lockfiles, and static markdown documentation:
yaml excludeFiles: - "**/*.test.{js,ts,jsx,tsx}" # Test files - "**/*.spec.{js,ts,jsx,tsx}" # Spec files - "**/__tests__/**" # Test directories - "package-lock.json" # NPM lockfile - "yarn.lock" # Yarn lockfile - "pnpm-lock.yaml" # PNPM lockfile - "bun.lockb" # Bun lockfile - "npm-shrinkwrap.json" # NPM shrinkwrap lock - "tsconfig.json" # TypeScript configs - "**/*.md" # Markdown documentation
Override Behavior: If you define excludeFiles in your codeagent.yml, it replaces the default list entirely. To keep the defaults, you must include them explicitly in your configuration list.

`lenses`

Scopes the AI Reviewer’s analysis to specific accessibility perspectives or framework rule packages.

Values: A list of active lenses (e.g., ["react"], ["nextjs"], ["vanilla"]).
Default: [] (defaults to the core vanilla ruleset)
Auto-detection behavior: By default, the accessFlow Code Agent AI Reviewer detects the framework used in your codebase and adjusts its accessibility suggestions automatically. If the lenses property is omitted or left empty, the system automatically scans your project's package.json and the files being edited to determine the appropriate framework dependencies. If it detects Next.js or React, it applies the corresponding lens. Otherwise, it defaults to the vanilla lens. In some cases, you may want to override this behavior. For example, if your project uses a custom or non-standard setup, you can define a specific lens to guide the AI Reviewer. This ensures that suggested fixes align with your preferred framework or coding patterns.

`skipIfInDraft`

Controls whether the AI Reviewer runs while a (PR) is still marked as a draft in GitHub.

By default, the AI Reviewer reviews draft PRs. Set skipIfInDraft to true to wait until the PR is marked Ready for review before running the review.

Values: true, false
Default: false

Example PR scan configuration

Here is an example codeagent.yml file:

# Place this file in the root of your repository

# Only report issues that are "high" or "extreme"
severityThreshold:"high"

# Block a PR from being merged if there are open "high" or "extreme" issues
blockingSeverity:"high"

# Do not report errors related to missing autofocus or empty links rules
ignoreRules:
- no-autofocus
- link-context

# 🚫 Exclude tests, legacy, and vendor folders from AI reviews
# Note: This completely replaces the default list of excluded files.
excludeFiles:
-"**/__tests__/**"
-"legacy-assets/**"
-"**/*.spec.tsx"

# Configure the active rule evaluation lenses
lenses:
-"vanilla"

# Turn off automatic reviews on PRs marked as draft 
skipIfInDraft: true

# (You will need to manually request a review via the GitHub UI)
autoReview:false

Repo scan configuration options

`enabled`

Turns the agentic repo scan on or off for this repository. This is the kill switch: if you ever need to stop the agent, set this to false (or delete .codeagent.yml) and push to your default branch - no other configuration change is required.

Values: true, false
Default: false - a repository with no .codeagent.yml, or one that omits this key, never opens agentic PRs.

This switch governs the agentic repo scan only. The PR reviewer is configured using autoReview.

`scheduleInterval`

Controls how often the agent scans your repository looking for issues to fix.

Values: "daily", "weekly"
Default: "weekly"
Specify a day: To run on a specific day of the week, combine this with scheduleDay.

`scheduleDay`

Runs a "weekly" repo scan on a specific day of the week. Specify this together with scheduleInterval: "weekly"

Values: "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"
Default: "sunday"

`scheduleTimeUtc`

The time of day (UTC) the repo scan runs at. Convert your local time to UTC.

Values: A 24-hour HH:MM string, e.g. "00:00", "14:30".
Default: "00:00"

`maxConcurrentPrs`

Caps how many agentic PRs can be open on this repository at once, so the agent does not overwhelm your review queue. Once the cap is reached, the agent waits for existing agentic PRs to be merged or closed before opening new ones.

Values: An integer from 1 to 10.
Default: 3

`agenticSeverityThreshold`

The minimum severity an issue must reach before the agent will open a PR to fix it.

Values: "low", "medium", "high", "extreme"
Default: "high"

severityThreshold = what does the reviewer report on a developer's PR?

agenticSeverityThreshold = what does the agent auto-suggest on its own?

For example, a common setup is a low severityThreshold (report everything on developer PRs) with a high agenticSeverityThreshold (only let the agent auto-suggest the worst issues).

`batchStrategy`

Controls how the agent splits the files it wants to scan into batches. The agent cannot send your whole repository to the model in one go, so it works through the files in priority order and fills a batch until the next file would exceed the size budget, then starts a new one. A batch always contains whole files.

One batch produces at most one PR.

Values: "size"
Budget is measured purely by how much code a batch contains - roughly 600 KB of source per batch - with no other grouping applied.
Default: "size"

`excludePaths`

Glob patterns for files and directories the agentic repo scan must never touch. Excluded files are filtered out during repository discovery, so their contents are never read or sent to the model.

Values: A list of standard glob patterns (e.g., "**/legacy/**", "**/vendor/**").
Default: [] (no additional paths excluded)

excludeFiles scopes the reactive PR reviewer

excludePaths scopes the autonomous repo scan. Set both if you want a directory invisible to both.

`excludeRules`

Accessibility rule IDs the agentic repo scan must never auto-suggest.

Values: A list of rule IDs (e.g., alt-misuse, button-mismatch).
Default: [] (no rules excluded from auto-fix)

ignoreRules stops the reactive PR reviewer from reporting a rule at all.

excludeRules only stops the agent from opening a fix for it. The reviewer can still report that rule on developer PRs.

Recommended example repo scan configuration

For a first rollout, start the agent on a narrow, low-risk slice of your policy and widen it once you trust the PRs it opens.

Here is an example to add to your codeagent.yml file:

# Turn the agent on, but keep its blast radius small to start
enabled: true

# Run once a week, off-hours (03:00 UTC on a Sunday)
scheduleInterval: "weekly"
scheduleDay: "sunday"
scheduleTimeUtc: "03:00"

# Only let the agent auto-suggest the worst issues at first
agenticSeverityThreshold: "extreme"

# Keep the queue small while you build confidence in the PRs it opens
maxConcurrentPrs: 1

# Steer clear of legacy and vendored code until you've reviewed a few PRs
excludePaths:
  - "**/legacy/**"
  - "**/vendor/**"
  - "**/third-party/**"

Once you are comfortable with the PRs the agent opens, widen its scope gradually. Lower agenticSeverityThreshold (e.g. "extreme" → "high") to let it fix more issues, raise maxConcurrentPrs to let more PRs be open at once, and shrink excludePaths as you clear out legacy debt in those directories.

accessiBe Help Center